Notes on Windows, macOS, Linux, Android, iOS, and the terminal, synced through your own server: Joplin pairs its open-source clients with Joplin Server, the official self-hosted backend that replaces Dropbox, OneDrive, or Nextcloud as the synchronization target. Notes are Markdown with inline attachments (images, PDFs, audio), organized into hierarchical notebooks and sub-notebooks with cross-cutting tags, alongside to-do lists with reminders and alarms. End-to-end encryption is the headline feature: enabled in the clients, it encrypts sync payloads on-device before upload, so the server stores blobs it cannot read - genuine protection even if the host is compromised. The desktop app offers both Rich Text and Markdown editors, extended by a plugin ecosystem, custom themes, and an Extension API for writing your own scripts; a Web Clipper for Chrome and Firefox captures full pages or screenshots straight into notebooks. Joplin Server ships as a Docker image with SQLite for evaluation and PostgreSQL for production, offers a filesystem storage driver for large content, and includes multi-user support and note sharing - all free under AGPL-3.0 when self-hosted. Notes stay in an open format, so the exit path always exists.

With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Grimoire captures, extracts, and indexes the content behind your bookmarks so you can search what pages actually say, not just their titles and URLs. The ingestion pipeline accepts links from the web UI, REST API, MCP server, browser bookmarklet, or bulk import, then fetches each page and extracts readable content using specialized parsers for GitHub repos, GitHub issues, StackOverflow threads, YouTube transcripts, PDFs, and standard web articles. Everything stores locally in SQLite with file-based content archives. Search operates in three modes: FTS5 keyword matching for exact terms, semantic embedding search for meaning-based retrieval using vector similarity, or a hybrid ranking mode combining both. Optional AI providers including OpenAI, Ollama, Anthropic, DeepSeek, and any OpenAI-compatible endpoint generate automatic tags, summaries, and embeddings without being required for core functionality. The interface built with React 18, Vite, TypeScript, Tailwind CSS, and Radix UI supports categories, nested tags, notes, archive and trash states, read-later flags, and multi-user isolated spaces. A single Bun-powered Hono process serves both the compiled frontend and the REST API on port 3210, requiring only one Docker container and a SQLite volume. Backup and restore export bookmarks, content, settings, and metadata as portable ZIP archives. Nearly 3,000 GitHub stars reflect growing adoption among developers and researchers. Running on a VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Running a VPN for family, friends, or a small team usually means babysitting servers one SSH session at a time, and Mistgate replaces that with one panel that keeps the whole fleet configured. Add a server from the browser by typing its address and root password: the panel pins the host key, checks the host, opens the ports, and installs the signed node agent for you. Each person gets one subscription link that their app turns into the server list, or a personal AmneziaVPN key per device, so a lost phone can be revoked without touching anyone else. Groups decide which protocol profiles a person receives, while per-user traffic quotas, expiry dates, device limits, and per-device speed limits keep sharing fair. Hysteria2 brings QUIC-based speed with port hopping, obfuscation, and certificate options; VLESS REALITY and AmneziaWG 2.0 and 3.1 cover networks where one protocol gets blocked, and Cloudflare WARP can serve as the exit for all three. Every five minutes the panel connects to each server the way a real client app would, a doctor on every node runs host checks with safe fixes, and alerts reach you on Telegram before your users notice. The public address shows strangers a decoy site while the admin hides behind a secret path, and encrypted backups go to your Cloudflare R2 bucket on a schedule. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Most file sharing leaves copies lying around forever; Tessera shares things with a built-in goodbye. Drop in a file, a whole folder, a code snippet, or a link and you get back a short code and a URL that anyone can open until it expires or hits the download count you set, at which point it is deleted. Expiry is checked on every request and each retrieval is counted atomically, so a one-time share cannot be raced by two people at once. Passwords can be required before anything is shown, code arrives syntax-highlighted, and images, SVGs, and diagrams preview in the page, with link cards when you paste the URL into chat. Uploads resume after interruptions and stream through the server without ballooning memory at any size. Behind the scenes you choose where bytes live: local disk, S3-compatible storage, Azure Blob, Google Cloud Storage, or WebDAV, several at once, added or retired from the admin panel without a restart. Accounts are optional for a home server, sign-in through OpenID Connect suits a team, and roles with per-account quotas decide who may upload, view everyone's shares, or change settings. Optional malware scanning, anonymous-upload caps, and rate-limited code lookups keep a public instance honest. A CLI and API tokens drive the same endpoints as the web app, so scripts can share and clean up exactly like people. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Watch YouTube without the ads, accounts, or tracking, from a server you own: TubeHaus is a private YouTube client that keeps the familiar layout, URLs, and keyboard shortcuts. Your subscriptions, watch history, resume positions, Watch Later, and playlists live as files on the server, so every device in the house shares one library and picks up a video where another screen left it. Live streams play with segments fetched ahead of the player, and captions are transcribed on the fly when a stream has none. Chapters, storyboard previews, a mini player, and theater mode make long videos easy to navigate, while sponsors are skipped automatically and dislike counts come back to the page. Save videos offline in 1080p or 4K for trips, send playback to a TV from your phone without a separate casting dongle, and drive the television interface entirely from a remote. Imports arrive from a Google Takeout export, Invidious, NewPipe, or FreeTube, so years of subscriptions move over in minutes instead of being rebuilt by hand. A calm mode hides recommendations and Shorts when you only want to search and watch deliberately. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When the connection drops, Project NOMAD keeps serving offline Wikipedia, Khan Academy courses, maps, and an optional private AI assistant from a single Debian-based Linux server. The core needs only about 5 GB of disk and under 1 GB of RAM. Content is what fills the drive, and a setup wizard sorts it into Essential, Standard, and Comprehensive tiers while a storage bar tracks the running total. Wikipedia runs from a quick-reference set of the top 100,000 articles to the complete English edition with images at about 121 GB, and Kiwix also serves medical references, survival and repair guides, and Project Gutenberg ebooks. Kolibri adds Khan Academy courses with multi-user progress tracking, and any browser on the network can study. Offline maps cover the whole globe, single countries, or regions, with markers you can search, color, and navigate to by coordinate. The AI assistant is the heavy part, bringing the install to roughly 25 GB. It chats through Ollama or any OpenAI-compatible server such as LM Studio, searches uploaded documents, lists sources with dates when known, and lets vision models read attached images. CyberChef handles encoding and hashing, and FlatNotes keeps Markdown notes. The Supply Depot adds one-click apps or your own Docker containers. Opt-in auto-updates for the Command Center, installed apps, and downloaded content run inside a window you set. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Several EU data protection authorities have ruled Google Analytics deployments unlawful; Matomo (formerly Piwik) is the most complete open-source replacement - a full analytics platform with 30+ report types across visitors, actions, referrers, goals, and ecommerce. The self-hosted PHP/MySQL edition is free and keeps every byte of visitor data on your infrastructure, which matters more each year: several EU data protection authorities have ruled Google Analytics deployments unlawful, while Matomo configured for cookieless tracking is approved by France's CNIL for use without a consent banner. All reporting runs on 100% unsampled data - no extrapolation at high traffic volumes. The GDPR Manager handles data subject requests and deletion, with IP anonymization, retention controls, and Do Not Track support built in. A dedicated importer pulls your historical Google Analytics data so years of trends survive the migration. Core analytics cover campaigns, custom variables and dimensions, entry/exit pages, downloads, site search, and full ecommerce tracking with a comprehensive HTTP API for reporting and ingestion. Premium plugins extend the platform into Hotjar-class behavioral tooling - click and scroll heatmaps, session recordings, conversion funnels, form analytics, A/B testing - plus a tag manager and SAML SSO. For teams that need GA-equivalent depth with actual data ownership, Matomo is the realistic drop-in replacement.

Page views, funnels, session replays, error reports, Core Web Vitals, and uptime checks share one cookieless dashboard in Betterlytics, so teams stop stitching several tools together. The overview charts visitors, page views, bounce rate, and visit duration against the previous period, and annotations mark launches or campaigns right on the timeline. Breakdowns cover referrers, channels, UTM campaigns, browsers, devices, and operating systems, with visitor locations on a world map once an optional MaxMind key is added. Custom events, global properties such as plan or app version, and outbound link tracking show what visitors actually do, while user journey diagrams and funnels reveal where they drift away. Session replay is opt-in per tracking script, masks text and form inputs by default, and can keep recordings in your own S3-compatible bucket. Error tracking groups JavaScript errors with stack traces, a session trail, and a link to the matching replay. Uptime and SSL monitors alert through Slack, Discord, Teams, or webhooks and feed public status pages on your own domain. Teammates join by invitation, two-factor login is available, and a built-in MCP server lets Claude, Cursor, or Codex answer traffic questions. A script of about 3.5 KB or a WordPress plugin handles installation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your medical history, fragmented across a dozen patient portals, in one place on your server: MediKeep (formerly Personal Medical Records Keeper) is a self-hosted health record system. Built with a React frontend and FastAPI backend over PostgreSQL, it organizes 14 categories of medical data - medications with dosages and schedules, conditions, procedures, allergies, immunizations, symptoms, injuries, doctor visits and encounters, treatments, lab results, and even medical equipment with service dates and supplier info. Treatment management is genuinely sophisticated: an advanced mode links treatments to their medications with per-medication overrides for prescriber, pharmacy, and effective dates, and reverse lookup shows which treatments use a given medication. A dashboard summarizes records and recent activity, file uploads attach documents to records, and tagging works across categories. When a new specialist asks for your history, the report builder assembles custom reports by category and exports to PDF, JSON, or CSV - a curated, portable summary instead of a folder of photocopies. Authentication supports Google and GitHub SSO with OIDC providers like Keycloak and Authelia expected to work, and the built-in backup system protects the archive. Health data is exactly what should never live in someone else's cloud.

Perplexity's search experience without Perplexity: Vane deploys Perplexica, an open-source AI answer engine built as the self-hosted alternative. Instead of returning a page of links, it reads your question, searches the live web through the SearxNG metasearch engine, and composes a direct answer with cited sources. Retrieval quality comes from embeddings and similarity search: fetched pages are re-ranked against the query so the model answers from the most relevant passages rather than whatever ranked first. Two query modes cover different needs - Normal mode runs a straightforward web search, while Copilot mode generates multiple reformulated queries and actively pulls content from top matches for harder questions. Focus modes specialize retrieval for academic papers, YouTube, Reddit discussions, Wolfram Alpha calculations, or the general web. The answering model is your choice: OpenAI-compatible APIs or fully local LLMs such as Llama 3 and Mixtral through Ollama, which keeps queries entirely on your infrastructure. Because SearxNG pulls live results, answers reflect current information, and no search history is tracked.

webtrees turns a GEDCOM family file into a private, collaborative genealogy website where relatives anywhere browse ancestors, add photos and sources, and edit together under privacy rules the owner controls. Import a file and each person gets a page of facts, events, and citations, with tabs for families, sources, places, media, and albums and a navigator that jumps to parents, spouses, children, and siblings. Pedigree, fan, hourglass, compact, descendant, interactive, lifespan, relationship, and timeline charts show the same people from different angles, and a pedigree map plots ancestors' birthplaces on OpenStreetMap. Lists sort and filter individuals, families, sources, notes, repositories, and media, with branches that group people by surname. A calendar surfaces births, deaths, marriages, and anniversaries for any day, month, or year, in Gregorian, Julian, Jewish, Hijri, or Jalali dates. Printable PDF reports cover Ahnentafel, family group, descendancy, birth, death, and cemetery records, and search offers general, advanced, and search-and-replace modes for authorized users. Privacy rules apply per site, tree, user, record, and fact, so only authorized users see living people and sensitive details. Editors propose changes, moderators approve them, one site hosts several trees, and the interface comes in more than 60 languages. GEDCOM export lets every tree move to desktop genealogy programs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Two decades of continuous development made Roundcube the standard-bearer of open-source webmail - a PHP IMAP client that gives any mail server a polished, application-like interface in the browser. It connects to whatever IMAP/SMTP stack you run - Dovecot, Postfix, a hosted mailbox - and delivers the full desktop-client experience: drag-and-drop message management, threaded conversation views, full MIME and HTML mail handling, find-as-you-type address book with groups and LDAP connectors, multiple sender identities, full-text search, and spell checking in dozens of languages. The default Elastic skin is genuinely responsive, working as well on a phone as a desktop, and the entire UI is skinnable. The plugin API is where deployments get shaped: managesieve exposes server-side filter management in the UI, enigma brings PGP encryption and signing via GnuPG, markasjunk trains spam filters, zipdownload batches attachments, password lets users change credentials, and attachment_reminder catches the classic forgotten-attachment email - among hundreds of community plugins. Built-in caching keeps large mailboxes fast, IMAP ACLs and shared folders support team setups, and XSS protection is engineered into the rendering pipeline. It scales from a single personal mailbox to unlimited users, backed by MySQL, MariaDB, PostgreSQL, or SQLite. GPL-licensed with regular security releases.

Your KeePass vaults, opened from any browser: KeeWeb reads, edits, and creates standard KDBX files, so it works with the same databases as KeePass and KeePassXC without conversion or lock-in. Self-hosting the web app gives you a password manager reachable from any modern browser, including mobile, with no client installation and no third-party cloud in the loop. All KDBX cryptography runs client-side; the server just serves the static app. Open multiple vault files simultaneously and search them all from one box, with advanced options covering specific fields, password history, and regular expressions. Vaults load from local files, your own server (WebDAV), or Dropbox, Google Drive, and OneDrive, with automatic sync - and files are cached for offline use, so a dropped connection never locks you out; changes resync once you're back online. Day-to-day niceties include a configurable password generator, protected fields that stay masked and are held in memory more defensively, entry history, tags with easy input, drag-and-drop attachments, and per-entry icons with favicon fetching. The optional KeeWeb Connect extension (Chrome, Firefox, Edge, Safari) autofills credentials using the keepassxc-protocol. MIT-licensed with matching desktop apps for macOS, Windows, and Linux.

Open the page, write a Markdown note, move on - Memos is a lightweight, self-hosted service built for quick capture. Instead of folders, notebooks, and titles, it presents a timeline: open the page, write a Markdown note, and move on. Notes support headings, code blocks with syntax highlighting, task lists, tables, and file attachments, with tags auto-extracted from #hashtags in the text. Each memo carries a visibility level, private, protected (logged-in users), or public, so one instance works as a personal log, a small team wiki, or a lightweight microblog. The backend is a single Go binary with a React frontend, around 50 MB of memory at runtime and a ~20 MB Docker image, so it fits comfortably on the smallest instance size with near-zero maintenance. SQLite is the default store, with MySQL and PostgreSQL supported for multi-user deployments needing more concurrency, and full REST and gRPC APIs - Connect RPC for browsers, gRPC-Gateway for external tools - make capture scriptable from CLIs, bots, and automation platforms. Fast full-text search spans all memos, pinned notes keep references handy, and a masonry view suits visual browsing. MIT-licensed with zero telemetry; content is stored as plain Markdown in a database you control, so notes remain readable, exportable, and free of proprietary formats.

Machine translation with no Google, no Azure, no per-character billing, and no text leaving your infrastructure: LibreTranslate is a free, open-source translation API that runs entirely on your own server. The engine underneath is Argos Translate, which runs OpenNMT neural models with SentencePiece tokenization and Stanza sentence-boundary detection, all offline. Models install as portable .argosmodel packages covering dozens of languages - English, Spanish, French, German, Chinese, Japanese, Russian, Arabic, Hindi, Portuguese, and many more - and Argos handles automatic pivoting: with es-to-en and en-to-fr installed, it chains them to translate es-to-fr without a direct model. The API is a straightforward HTTP POST to /translate with source and target language codes, returning JSON - simple enough that the ecosystem has clients in every major language and integrations across tools like Weblate and Mastodon. Beyond plain text it translates HTML while preserving markup and handles whole file uploads (documents in, translated documents out), plus automatic language detection when the source is unknown. A clean bundled web UI serves interactive translation for end users, and optional API keys with rate limits control access. AGPL-licensed and trainable with custom models, it is the standard answer when translation must be private, unmetered, and self-contained - GDPR-sensitive text never touches a third party.

Moltis gives individuals and teams a completely private personal AI agent server that bridges conversational assistants to everyday messaging platforms while executing real-world computing tasks inside secure execution environments. Users can interact with autonomous agents across Telegram, Discord, WhatsApp, Slack, Matrix, and browser interfaces to draft correspondence, automate research, and schedule recurring cron tasks. The system coordinates multi-agent delegation by spinning up specialized sub-agents with dedicated roles for code generation, pull request reviews, quality assurance testing, and technical documentation. Built-in sandboxing isolates tool operations within container boundaries or WebAssembly modules, ensuring shell commands, web scraping routines, and script executions cannot alter underlying operating system files without explicit permission. Native Model Context Protocol integration allows operators to attach external data endpoints, database connectors, and custom command-line utilities without rewriting core routing logic. Persistent memory preserves conversational context and document embeddings across multiple sessions, allowing assistants to recall prior discussions, user preferences, and project guidelines indefinitely. Administrators can configure granular tool approvals, manage WebAuthn passkey authentication, and review real-time WebSocket communication logs through an embedded control panel. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

SnappyMail is a fast, privacy-respecting webmail client that connects to any existing IMAP and SMTP server, booting in under a second with a JavaScript payload of just 138 KB under Brotli compression (down from RainLoop's 8 MB fork origin). No database is required: all configuration and user data persists as flat files in a single volume, making Docker deployment trivially simple with the roughly 30 MB image consuming approximately 50 MB of RAM. Built-in PGP encryption supports three backends: OpenPGP.js v5 with ECDSA and EDDSA key generation, GnuPG integration, and Mailvelope browser extension compatibility, eliminating the need for separate encryption plugins. The integrated Sieve script editor enables users to create mail filtering rules, vacation auto-responders, and forwarding conditions directly within the web interface when connected to ManageSieve-capable servers on port 4190. Multi-domain administration allows a single instance to serve users across multiple IMAP servers with per-domain authentication routing. The admin panel manages extensions, security settings, branding customization, and domain configuration. GDPR-friendly by design, it removes all social media integrations, Gravatar lookups, and external tracking present in RainLoop. Dark mode strips background and font colors from email messages. The modified Squire HTML editor replaces CKEditor for composing rich-text messages. Scores 99% on Lighthouse performance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.